Extracted

• • Target

    cc3eddbcaaecb9c3aa935de36d52794a_JaffaCakes118

  • Size

    236KB

  • MD5

    cc3eddbcaaecb9c3aa935de36d52794a

  • SHA1

    1cfc3b467c7d821ce8f8d2b165075f80956ca405

  • SHA256

    eb15fc02eb127af8c491bf22f234690d8e7581028b6f4cba8a0fc45b186d0553

  • SHA512

    79d8d25ade1381ddadd1606179a6d007d62499bb173187cb822574485397b01bf0ccc9e0797783072e6e863e388438886ac2107be6ed75b87603ef255d4e7dbf

  • SSDEEP

    6144:Kx04/K////////hcmFeiZPBXmKcpCtwyEaDGRZL1MsMyrShpyHIBI/////MFK/F:KocmMitvcpCtF6RZL1M3gIyHIa

  Score

  10^/10

  latentbotdiscoveryevasionpersistencetrojanupx

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Modifies firewall policy service

    evasion

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2